Forum Discussion
Get full data into Playbook
Hi
We are currently trying to automate some alerts through Playbooks.
We created a custom alert that checks for Impossible Travel Alerts from MCAS.
This works well. But the issue is that some data that is in the SecurityAlerts table (like ExtendedProperties and Entities) isn't forwarded to the Logic App when it's triggered by Sentinel.
I attached a screenshot of what data is forwarded through a logic app
Because Sentinel Entities do not support an array, but only one value. It's not possible to use those, because an impossible travel alert has multiple IP's.
So we are looking for another way to get all the data of a Sentinel alert into a playbook.
Should we query log analytics for this? I don't really like doing this, because this seems like an unnecessary step.
Does anybody have something for this?
- Absolutely, one event will only have up to a single value for each of the entities.
Thijs Lecomte This is something I have done and probably you could do.
Entities and Extended properties are JSON parameters. Using the data operations connector parse these parameters. You could get the JSON schema from the entities/extended properties logs.
Almost all of the times the scheduled query is available in the Extended properties. By parsing you will convert JSON into String and take the Query parameter out. Initialize the variable naming it as XYZ and use Query with a time period(this is must).
Using Azure Log Analytics run this initialized variable and you should be good to go.. Seems like a lot of pain but works just fine.
That's how I do it too ATM.
But this means there is an extra query to log analytics which seems unnecessary to me... Shouldn't this be available by default?
GaryBushey Some data that I see in the SecurityAlerts table isn't able in the Playbook. These are columns like 'Entities' and 'ExtendedProperties' (these are columns that contain extra data from MCAS).
Thijs Lecomte I believe what @Pranesh1060 meant is that you can take the Extended properties and the Entities fields and use the Logic Apps Parse JSON action to extract the information. There is no reason to perform another query against Log Analytics.
Thijs Lecomte Not sure what you mean when you say that Entities do not support arrays. If the alert that creates the Incident finds multiple events and each of those events has matching entities, then the incident will have multiple entities.
I currently have one incident that is made up of 13 events and has 5 IP and 6 Account Entities in it. Using a Playbook to write the Entities to a Teams message I see that it writes out the Entities in a JSON array.
Looking at your image it shows the same thing just that, in your case, you only have 1 Entity listed
- Thanks for the response.
The alert is have only has one event.
The event that comes from MCAS.
I can understand that multiple events in one alert can lead to multiple entities.
But can one event in an alert lead into multiple entities?
Or is there another way to get the full event details into Playbooks?Thijs Lecomte One event will only have up to a single value for each of the entities.
